Consumer Apps · Health/Fitness (GPS activity tracking) · Structural / no discrete incident
Strava
Headline
Strava's privacy policy (per an earlier review; not re-verified this pass) states it pulls in data from whatever you connect — your Peloton account, Garmin device, or Apple Health…
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Strava's privacy policy (per an earlier review; not re-verified this pass) states it pulls in data from whatever you connect — your Peloton account, Garmin device, or Apple Health — including heart rate, sleep, HRV, and VO2max. Strava says it won't sell or advertise with that specific health data. But the company's own aggregated public 'Global Heatmap' has repeatedly done something no advertiser ever could: reveal secret military base layouts in active conflict zones, expose the movements of world leaders' security teams, and help locate the French aircraft carrier Charles de Gaulle — all just from soldiers and sailors logging ordinary runs. The privacy risk here isn't a company selling your data on purpose; it's that thousands of individually-innocent workout logs, aggregated together, can accidentally reveal exactly what a nation's military is trying hardest to hide.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-08-04
Primary source. None recorded — Unverified - heuristic first draft.
Terms
Arbitration
Not independently confirmed this pass — standard binding arbitration + class action waiver expected.
Data sharing
GENUINE NATIONAL-SECURITY-SCALE PRIVACY FAILURE, repeated across multiple years: Strava's public 'Global Heatmap' (built from aggregated user workout GPS data) has repeatedly exposed sensitive locations — in 2018 it revealed US/allied military base layouts in places including Syria and Afghanistan because soldiers logged runs on base without realizing routes were public; in 2022 an Israeli NGO (FakeReporter) showed that Strava's segments feature could be exploited to identify and track security personnel at Israeli military bases (a reported figure of 100+ individuals at six facilities was not re-verified this pass); in 2025, Le Monde reported that French nuclear-submarine crew members' public Strava activity at the Île Longue base allowed patrol timings to be deduced; in March 2026, a sailor revealed a French aircraft carrier's location by logging an on-deck run. Separately, Le Monde reporting found the movements of world leaders' bodyguards could be tracked via their own public Strava accounts near meeting venues. Strava's 'Metro' program also provides de-identified but highly granular aggregated movement data to city governments and transportation agencies (Strava states Metro access is free of charge); numerous third-party apps (a figure of 700+ was reported earlier but not re-verified this pass) can access a connected user's GPS routes, heart rate, and performance data via Strava's API.
Fees and billing
Not itemized this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
No sources are on file for this row yet.
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy strava.com/legal/privacy | Not fetched yet | NO (HTML only) |
| Terms of service strava.com/legal/terms | Not fetched yet | NO (HTML only) |
| Website No URL recorded | Not fetched yet | — |
| Primary source No URL recorded Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
No HQ state on file, so no state statute applies by headquarters.